Tutorials Journalism

A Verification Method That Survives Being Challenged

By Infinite Creation · Intermediate · ~14 min

Overview

There is a difference between checking a video and running a verification. Checking is a set of techniques applied until you feel convinced. A verification is a procedure with a written record, which means somebody else can follow what you did, see what you relied on, and find the point where they disagree. That difference is what makes a finding defensible. The best documented method in the field is the Berkeley Protocol on Digital Open Source Investigations, published by the UN human rights office and the Human Rights Center at Berkeley Law in 2022 for investigating violations of international criminal, human rights and humanitarian law. Its structure adapts cleanly to a newsroom, and this page follows it.

Kit and Prerequisites

The item itself, downloaded and stored, before anything else happens to it
A way to compute and record a hash of that file
A document, per item, that records what you did and what you concluded
A second person willing to argue with your conclusion
A willingness to publish a weaker claim than the one you hoped for

Working Through It

Write the claim down before you test it

State what the item is being said to show, in one sentence, with a place, a time and an actor. A vague claim cannot be verified or refuted, and the Protocol makes exactly this point about sources: the more precise the information and the claims, the easier they are to prove or disprove, while broad and vague claims are harder to assess critically. Writing the sentence first also stops the claim quietly softening as the evidence disappoints.

Preserve the item before you analyse it

Download it, store it, and record a hash of the file. The Protocol treats preservation as a stage in its own right, ahead of verification, and recommends checking hash values of random samples regularly so that storage degradation is caught. Do this first because the thing you are verifying can be deleted, edited or re-uploaded while you work, and because a hash recorded at the start is what later proves the file you published about is the file you examined.

Analyse the source, separately from the item

The Protocol splits verification into three considerations: the source, the digital item, and the content. Source analysis asks about credibility and reliability. Look at posting history and online presence, which can catch a deliberate attempt to deceive. Look at independence: what affiliations exist, how the source makes money and from whom, and whether there are connections to any party in the incident. Note that the Protocol says a lack of attribution is not generally critical, because an item can be authenticated other ways.

Trace provenance to the earliest copy you can actually find

Provenance is the origin or earliest known existence of the item. The Protocol is precise about the language here and it is worth copying: prefer the phrase first copy found online rather than the first copy online, because the original may have been removed, and because items circulate in closed channels such as email and private messaging groups before they appear in public. Record which copy you found first and how you searched, so the next person can find an earlier one if it exists.

Analyse the file

Technical analysis tests the integrity of the item itself. Metadata may describe the creator, creation date, upload data, modifications, file size and geodata, and may sit in the file, on the page or in the source code. Be careful with what it means. Platforms transcode uploads, so metadata often reflects the new file rather than the original, and stripped metadata is normal rather than suspicious. Where metadata are gone, the Protocol says to find another route to verification rather than treating the absence as a finding.

Analyse the content

Content analysis assesses what is inside the frame. Start with unique or identifying features: buildings, plant life, people, symbols and insignia. The Protocol flags three failure modes specific to online material, and they are the ones that catch newsrooms: circular reporting, where the same claim returns as apparent corroboration, decontextualisation, and misinterpretation. It also urges caution in analysing human features with the aim of identifying a specific person.

Compare the three and go looking for the inconsistency

The Protocol says the three considerations should be looked at collectively and compared for consistency, and that is the step people skip. A credible source, an intact file and a plausible scene are three separate findings, and the verification is the comparison between them. Run more than one working hypothesis. The Protocol names multiple working hypotheses and peer review as the way accuracy is improved, because both reduce biased selection and interpretation.

Check any Content Credential for what it does and does not assert

If the item carries C2PA provenance data, read it for what the specification says it means. C2PA defines authenticity as a set of facts, such as the provenance data and hard bindings, that can be cryptographically verified as not having been tampered with. That is a statement about the file, not about the world. A signed manifest can attest that an image has not changed since signing and still describe a scene that was staged. Absence of a credential proves nothing either.

State the finding at the strength the evidence supports

Write the conclusion and the reasoning, including what you could not establish. The Protocol is direct about this: be truthful and precise, especially in acknowledging weaknesses in the underlying data, do not exaggerate or overstate analytical conclusions, and use clear, objective, fact-based language while avoiding emotive language. A published verification that names its own gaps is far harder to knock down than one that claims certainty and turns out to have had none.

Worth knowing:

Verified and true are different words. You can verify that a video was shot where it is claimed and still not know what it shows.
Circular reporting is the most common failure in fast news. Before counting a second account as corroboration, check it is not repeating the first.
Record the negative results too. Knowing that a reverse image search found nothing is useful to the next person, and it stops the search being repeated.
Give the file a hash at the moment you download it. It costs one command and it is the only thing that later proves which file you examined.
A verification log that lives in the same folder as the material is a log that gets kept. One that lives in a separate system is one that gets abandoned.

Knowledge Base

The Longer Answer

The method exists to make disagreement productive. Somebody who doubts your finding should be able to see which of the three analyses they doubt.

Why the three-way split does the work

The reason to separate the source, the file and the content is that each can be strong while the others are weak, and a single overall impression hides that. An anonymous account can post an intact file of a real event. A reliable news organisation can post a genuine photograph with the wrong caption. A file whose metadata was stripped by an upload tells you nothing either way. Judged as one blurred impression, these all collapse into a feeling about whether the item seems right. Judged separately and then compared, they produce something you can write down and somebody else can check, and the comparison itself is often where the problem shows up.

What a verification log should contain

One document per item, and it does not need to be elaborate. The claim as stated, in one sentence. Where the item was found, when, and the hash of the file you downloaded. The earliest copy you could locate and how you searched for it. What the source analysis found, including the negative results. What the file showed, and what was absent because a platform stripped it. What the content showed, listed as individual observations rather than a conclusion. Then the comparison, the working hypotheses considered, who reviewed it, and the finding written at a strength you would defend in public. Everything in that list is cheap to record while you work and expensive to reconstruct afterwards.

Where This Fits

Verification is one of the four field skills in Mobile Journalism, beside shooting, filing and the kit.

FAQ

Q: How is this different from your page on verifying found video?
A: That page is the technique set: reverse image search, cross-checking location, what metadata can and cannot prove. This page is the procedure those techniques sit inside, covering what to record, in what order, and how strongly to state the result. Use both together.

Q: Do I need to identify who posted something?
A: It helps, but the Berkeley Protocol states that a lack of attribution is not generally critical for establishing an item authenticity, because there are other ways to authenticate open source information. Chasing an identity you cannot establish is often less useful than analysing the file and the content.

Q: Does a Content Credential mean the video is real?
A: It means something narrower. C2PA defines authenticity as facts that can be cryptographically verified as not having been tampered with, which is a claim about the file and its recorded history rather than about the truth of what it depicts.

Q: What if the metadata has been stripped?
A: That is the normal case for anything that has passed through a social platform, because uploads are transcoded. The Protocol treats stripped metadata as a reason to verify another way, not as evidence of manipulation.

Q: How certain do I have to be before publishing?
A: Certain enough to state the finding and its weaknesses in the same sentence. The Protocol asks for accuracy in acknowledging weaknesses in the underlying data and for conclusions that are not exaggerated or overstated. A qualified finding is publishable and an overstated one is a liability.

Vocabulary

Source analysis Assessing the credibility and reliability of whoever put an item online, using posting history, online presence, affiliations, funding and any connection to the parties involved. The Berkeley Protocol treats it as one of three considerations that are compared with each other rather than as a verdict on its own.

Technical analysis Examination of the digital item itself to test whether it has been altered, including metadata such as creator, creation date, upload data, modifications, file size and geodata. Platform transcoding often replaces original metadata, so an absence is usually a sign of processing rather than of deception.

Content analysis Assessment of what is inside the item, beginning with unique or identifying features such as buildings, plant life, people, symbols and insignia. Its named failure modes are circular reporting, decontextualisation and misinterpretation, all of which can survive a file that is technically intact.

Provenance The origin or earliest known existence of an item. For online material the Berkeley Protocol prefers the phrase first copy found online to the first copy online, because originals get deleted and because items circulate in email and private groups before they appear anywhere public.

Circular reporting A false corroboration in which an account traced back far enough turns out to rest on the same original claim you are trying to check. It is one of the failure modes the Berkeley Protocol names for online content, and it is the most common way a newsroom convinces itself under time pressure.

Sources

Both documents below were downloaded and read. Quotations of what they require are taken from those documents rather than from a summary. Checked 27 August 2026.

Berkeley Protocol on Digital Open Source Investigations, United Nations and the Human Rights Center, Berkeley Law, 2022. The method this page follows. Its investigation process runs from online inquiries through preliminary assessment, collection, preservation, verification and investigative analysis to reporting. Verification is broken into source analysis, technical analysis and content analysis, which it says should be looked at collectively and compared for consistency. It defines provenance and prefers the phrase first copy found online, states that lack of attribution is not generally critical to establishing authenticity, warns that platform transcoding replaces original metadata, names circular reporting, decontextualisation and misinterpretation as content risks, and requires that conclusions not be exaggerated or overstated and that weaknesses in the underlying data be acknowledged.
C2PA Technical Specification, version 2.4. Read for the definitions used above. It defines authenticity as a property of digital content comprising a set of facts, such as the provenance data and hard bindings, that can be cryptographically verified as not having been tampered with. It defines a hard binding as one or more cryptographic hashes uniquely identifying an asset or part of one, and gives Content Credential as the preferred non-technical term for a C2PA manifest.

The Berkeley Protocol was written for investigations into violations of international criminal, human rights and humanitarian law, where the standard of proof and the legal consequences are higher than in most newsroom work. This page adapts its structure and quotes its requirements accurately, but it is an adaptation. Where you are working to a legal standard rather than an editorial one, read the Protocol itself, including its sections on security and on the legal framework, which this page does not cover.